Oopsies: Mass. General worker loses confidential patient data on the Red Line

HIPAA doesn't actually forbid taking confidential information out of buildings, like many of the commenters on the Glob site are saying. It prohibits taking ORIGINAL MEDICAL RECORDS out of a building (unless like you're moving an office and you have a plan in place to move them of course). Someone mentioned signing out records; it's standard practice to sign a log if removing something from a record, and you generally wouldn't be taking it out of the building.

But a billing printout isn't part of a patient's medical record. It's confidential information under HIPAA, yes, but it's not part of a medical record. There's a distinction. HIPAA says it's fine to work at home, but that precautions need to be taken. It doesn't say how to take these. I've worked at many places where one is allowed to take paperwork home (but never take an original document that isn't backed up somehow out of a medical record). This is pretty standard practice. Also, when someone is on-call and is at home, they need to have access to basic history of people about whom they may be receiving calls. Not everywhere can have fancy electronic systems, so most smaller programs have a binder that the on-call person takes home. S/he needs to be careful with it, yes, but human error does happen.

Also, many places that are subject to HIPAA do home visits or assessments in schools or other places. I currently work somewhere where we do a lot of home visits. We have confidential information with us. I have a grid of my clients' names and addresses and DOBs and phone numbers in my day planner, and I have progress notes and testing data with me at the end of the day that I need to take back and put into the medical record. All of this is acceptable practice. I take precautions to not leave my bag anywhere, but my car or my house could get broken into. If this happened, I'm sure there would be all sorts of uninformed people saying I shouldn't have been allowed to take this information out of the building, but then we wouldn't be able to provide in-home services, or observe kids at daycare, or any number of other clinically necessary services.

HIPAA doesn't guarantee that no medical records will ever be wrongly released anywhere ever. It guarantees that reasonable precautions will be taken. There's no evidence that they weren't in this situation. We're not about to send armed bodyguards out with people any time confidential information is being transported.